From 6d74e7dc130ab59247bbb0937e17875e21409d2c Mon Sep 17 00:00:00 2001 From: Andrei Regiani Date: Thu, 25 Jun 2026 05:55:28 -0300 Subject: [PATCH 1/6] make-pear-app: macOS .app bundle --- make-pear-app/README.md | 26 ++++++++++++++------------ make-pear-app/action.yml | 15 +++++++++++++++ 2 files changed, 29 insertions(+), 12 deletions(-) diff --git a/make-pear-app/README.md b/make-pear-app/README.md index 8ed2c5c..5ed2044 100644 --- a/make-pear-app/README.md +++ b/make-pear-app/README.md @@ -14,20 +14,21 @@ GitHub Action to build Pear apps on Linux, macOS, and Windows, with code signing ### Windows -| Input | Description | Required | -| ------------------------- | ---------------------------------------------------------------- | ---------------------------------------------------------------------- | -| `windows_msix` | Windows MSIX to upload | No | -| `windows_zip` | Windows ZIP to upload | No | -| `windows_signing_method` | Signing method to use: `windows_cert_sha1` or `windows_cert_pfx` | Required on Windows | -| `windows_cert_sha1` | SHA1 thumbprint of the Windows cert | Required on Windows if `windows_signing_method` is `windows_cert_sha1` | -| `windows_cert_pfx_base64` | Base64-encoded Windows cert pfx file | Required on Windows if `windows_signing_method` is `windows_cert_pfx` | -| `windows_cert_password` | Password for the Windows certificate | Required on Windows if `windows_signing_method` is `windows_cert_pfx` | +| Input | Description | Required | +| ------------------------- | ------------------------------------------------ | -------------------------------------------------------------- | +| `windows_msix` | Windows MSIX to upload | No | +| `windows_zip` | Windows ZIP to upload | No | +| `windows_signing_method` | Signing method to use: `cert_sha1` or `cert_pfx` | Required on Windows | +| `windows_cert_sha1` | SHA1 thumbprint of the Windows cert | Required on Windows if `windows_signing_method` is `cert_sha1` | +| `windows_cert_pfx_base64` | Base64-encoded Windows cert pfx file | Required on Windows if `windows_signing_method` is `cert_pfx` | +| `windows_cert_password` | Password for the Windows certificate | Required on Windows if `windows_signing_method` is `cert_pfx` | ### macOS | Input | Description | Required | | --------------------------- | ------------------------------------------------------------------------------ | ----------------------------------------------------------------------- | | `macos_dmg` | macOS DMG to upload | No | +| `macos_app` | macOS app bundle tarball to upload | No | | `macos_certificate_base64` | Base64 Apple development certificate (P12) | Required on macOS | | `macos_p12_password` | Password for the P12 certificate | Required on macOS | | `macos_codesign_identity` | Code signing identity | Required on macOS | @@ -57,13 +58,13 @@ jobs: runs-on: windows-latest steps: - uses: actions/checkout@v4 - - uses: holepunchto/make-pear-app + - uses: holepunchto/actions/make-pear-app@v1 with: channel: production upgrade_key: pear://jj7jywoj83pswtcf5asywbm4ngro3xikgg1zcaqq3kdyhghats6o windows_msix: Keet.msix windows_zip: Keet-win32-x64-4.17.0.zip - windows_signing_method: windows_cert_sha1 + windows_signing_method: cert_sha1 windows_cert_sha1: ${{ secrets.WINDOWS_CERT_SHA1 }} ``` @@ -75,11 +76,12 @@ jobs: runs-on: macos-latest steps: - uses: actions/checkout@v4 - - uses: holepunchto/make-pear-app + - uses: holepunchto/actions/make-pear-app@v1 with: channel: production upgrade_key: pear://jj7jywoj83pswtcf5asywbm4ngro3xikgg1zcaqq3kdyhghats6o macos_dmg: Keet-4.17.0-arm64.dmg + macos_app: Keet-4.17.0-arm64.app.tgz macos_certificate_base64: ${{ secrets.CERTIFICATE_P12 }} macos_p12_password: ${{ secrets.CERTIFICATE_PASSWORD }} macos_codesign_identity: ${{ secrets.MAC_CODESIGN_IDENTITY }} @@ -97,7 +99,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - - uses: holepunchto/make-pear-app + - uses: holepunchto/actions/make-pear-app@v1 with: channel: production upgrade_key: pear://jj7jywoj83pswtcf5asywbm4ngro3xikgg1zcaqq3kdyhghats6o diff --git a/make-pear-app/action.yml b/make-pear-app/action.yml index 75f24af..eb38230 100644 --- a/make-pear-app/action.yml +++ b/make-pear-app/action.yml @@ -17,6 +17,10 @@ inputs: description: 'macOS DMG to upload' required: false default: '' + macos_app: + description: 'macOS app bundle tarball to upload' + required: false + default: '' macos_certificate_base64: description: 'Base64-encoded Apple distribution certificate (P12 format)' required: false @@ -210,6 +214,17 @@ runs: name: ${{ inputs.macos_dmg }} path: out/make/**/${{ inputs.macos_dmg }} if-no-files-found: error + - name: 'Create macOS app bundle artifact' + if: ${{ runner.os == 'macOS' && inputs.macos_app != '' }} + run: cd out && tar -czf "${{ runner.temp }}/${{ inputs.macos_app }}" *-darwin-*/*.app + shell: bash + - name: 'Upload macOS app bundle artifact' + if: ${{ runner.os == 'macOS' && inputs.macos_app != '' }} + uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + with: + name: ${{ inputs.macos_app }} + path: ${{ runner.temp }}/${{ inputs.macos_app }} + if-no-files-found: error - name: 'Upload Windows MSIX artifact' if: ${{ runner.os == 'Windows' && inputs.windows_msix != '' }} uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 From a6a4ded35a8cd6fbe9c10f5d4142f0c162cf45e9 Mon Sep 17 00:00:00 2001 From: Andrei Regiani Date: Thu, 25 Jun 2026 06:12:32 -0300 Subject: [PATCH 2/6] fix zizmor --- make-pear-app/action.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/make-pear-app/action.yml b/make-pear-app/action.yml index eb38230..68f0b9e 100644 --- a/make-pear-app/action.yml +++ b/make-pear-app/action.yml @@ -216,7 +216,9 @@ runs: if-no-files-found: error - name: 'Create macOS app bundle artifact' if: ${{ runner.os == 'macOS' && inputs.macos_app != '' }} - run: cd out && tar -czf "${{ runner.temp }}/${{ inputs.macos_app }}" *-darwin-*/*.app + env: + MACOS_APP: ${{ inputs.macos_app }} + run: cd out && tar -czf "$RUNNER_TEMP/$MACOS_APP" *-darwin-*/*.app shell: bash - name: 'Upload macOS app bundle artifact' if: ${{ runner.os == 'macOS' && inputs.macos_app != '' }} From c0ea7dbe7c245d005e1bb66952d1572788f54442 Mon Sep 17 00:00:00 2001 From: Andrei Regiani Date: Tue, 30 Jun 2026 14:52:18 -0300 Subject: [PATCH 3/6] fix merge conflicts --- make-pear-app/README.md | 2 ++ make-pear-app/action.yml | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/make-pear-app/README.md b/make-pear-app/README.md index b822682..151d7d1 100644 --- a/make-pear-app/README.md +++ b/make-pear-app/README.md @@ -31,6 +31,7 @@ GitHub Action to build Pear apps on Linux, macOS, and Windows, with code signing | Input | Description | Required | | --------------------------- | ------------------------------------------------------------------------------ | ----------------------------------------------------------------------- | | | `macos_app` | macOS app bundle tarball to upload | No | +| `macos_dmg` | macOS DMG to upload | No | | `macos_dmg_artifact_name` | macOS DMG uploaded artifact name | No | | `macos_certificate_base64` | Base64 Apple development certificate (P12) | Required on macOS | | `macos_p12_password` | Password for the P12 certificate | Required on macOS | @@ -89,6 +90,7 @@ jobs: channel: production upgrade_key: pear://jj7jywoj83pswtcf5asywbm4ngro3xikgg1zcaqq3kdyhghats6o macos_app: Keet-4.17.0-arm64.app.tgz + macos_dmg: Keet-4.17.0-arm64.dmg macos_dmg_artifact_name: Keet-4.17.0-arm64 macos_certificate_base64: ${{ secrets.CERTIFICATE_P12 }} macos_p12_password: ${{ secrets.CERTIFICATE_PASSWORD }} diff --git a/make-pear-app/action.yml b/make-pear-app/action.yml index b46e2fc..8d0cbf0 100644 --- a/make-pear-app/action.yml +++ b/make-pear-app/action.yml @@ -17,6 +17,10 @@ inputs: description: 'name for the uploaded standalone artifact' required: false default: '' + macos_dmg: + description: 'macOS DMG to upload' + required: false + default: '' macos_app: description: 'macOS app bundle tarball to upload' macos_dmg_artifact_name: From ec2b1ddc0fdfa78da3882fde02571ae8284b5ca5 Mon Sep 17 00:00:00 2001 From: Andrei Regiani Date: Tue, 30 Jun 2026 15:44:16 -0300 Subject: [PATCH 4/6] lint --- make-pear-app/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/make-pear-app/README.md b/make-pear-app/README.md index 151d7d1..b8ef9c7 100644 --- a/make-pear-app/README.md +++ b/make-pear-app/README.md @@ -29,7 +29,7 @@ GitHub Action to build Pear apps on Linux, macOS, and Windows, with code signing ### macOS | Input | Description | Required | -| --------------------------- | ------------------------------------------------------------------------------ | ----------------------------------------------------------------------- | | +| --------------------------- | ------------------------------------------------------------------------------ | ----------------------------------------------------------------------- | | `macos_app` | macOS app bundle tarball to upload | No | | `macos_dmg` | macOS DMG to upload | No | | `macos_dmg_artifact_name` | macOS DMG uploaded artifact name | No | From 20687cd785b5dd48ba2ed4d7863ce81fca05ce2b Mon Sep 17 00:00:00 2001 From: Andrei Regiani Date: Tue, 30 Jun 2026 15:49:07 -0300 Subject: [PATCH 5/6] security fix --- restore-fuzz-corpus/action.yml | 2 +- save-fuzz-corpus/action.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/restore-fuzz-corpus/action.yml b/restore-fuzz-corpus/action.yml index be8b530..a8cbcba 100644 --- a/restore-fuzz-corpus/action.yml +++ b/restore-fuzz-corpus/action.yml @@ -12,7 +12,7 @@ inputs: runs: using: composite steps: - - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 + - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 with: path: ${{ inputs.path }} key: ${{ inputs.key }}-${{ github.run_id }} diff --git a/save-fuzz-corpus/action.yml b/save-fuzz-corpus/action.yml index 098257f..be9a396 100644 --- a/save-fuzz-corpus/action.yml +++ b/save-fuzz-corpus/action.yml @@ -15,7 +15,7 @@ inputs: runs: using: composite steps: - - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 + - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 if: always() with: path: ${{ inputs.path }} From 85889f4c57702632fed6d7821811dbd98478dd9b Mon Sep 17 00:00:00 2001 From: Andrei Regiani Date: Thu, 2 Jul 2026 07:49:54 -0300 Subject: [PATCH 6/6] use ditto --- make-pear-app/README.md | 4 ++-- make-pear-app/action.yml | 7 +++++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/make-pear-app/README.md b/make-pear-app/README.md index b8ef9c7..25e9ed1 100644 --- a/make-pear-app/README.md +++ b/make-pear-app/README.md @@ -30,7 +30,7 @@ GitHub Action to build Pear apps on Linux, macOS, and Windows, with code signing | Input | Description | Required | | --------------------------- | ------------------------------------------------------------------------------ | ----------------------------------------------------------------------- | -| `macos_app` | macOS app bundle tarball to upload | No | +| `macos_app` | macOS app bundle ZIP archive to upload | No | | `macos_dmg` | macOS DMG to upload | No | | `macos_dmg_artifact_name` | macOS DMG uploaded artifact name | No | | `macos_certificate_base64` | Base64 Apple development certificate (P12) | Required on macOS | @@ -89,7 +89,7 @@ jobs: with: channel: production upgrade_key: pear://jj7jywoj83pswtcf5asywbm4ngro3xikgg1zcaqq3kdyhghats6o - macos_app: Keet-4.17.0-arm64.app.tgz + macos_app: Keet-4.17.0-arm64.app.zip macos_dmg: Keet-4.17.0-arm64.dmg macos_dmg_artifact_name: Keet-4.17.0-arm64 macos_certificate_base64: ${{ secrets.CERTIFICATE_P12 }} diff --git a/make-pear-app/action.yml b/make-pear-app/action.yml index 8d0cbf0..0a74db8 100644 --- a/make-pear-app/action.yml +++ b/make-pear-app/action.yml @@ -22,7 +22,7 @@ inputs: required: false default: '' macos_app: - description: 'macOS app bundle tarball to upload' + description: 'macOS app bundle ZIP archive to upload' macos_dmg_artifact_name: description: 'name for the uploaded macos dmg artifact' required: false @@ -244,7 +244,10 @@ runs: if: ${{ runner.os == 'macOS' && inputs.macos_app != '' }} env: MACOS_APP: ${{ inputs.macos_app }} - run: cd out && tar -czf "$RUNNER_TEMP/$MACOS_APP" *-darwin-*/*.app + run: | + ditto -c -k --sequesterRsrc --keepParent \ + out/*-darwin-*/*.app \ + "$RUNNER_TEMP/$MACOS_APP" shell: bash - name: 'Upload macOS app bundle artifact' if: ${{ runner.os == 'macOS' && inputs.macos_app != '' }}